🔒 Security release — Aikido pentest-audit remediation
This release fixes every CRITICAL and HIGH finding from an authorized Aikido penetration-test audit of PegaProx, each verified end-to-end against a live lab and fixed before release.
Critical
- Console PVE-ticket leak — the VNC/termproxy console no longer hands the cluster-wide PVE session ticket (effectively root on
pve:8006) to the browser. The standalone WS proxy now fetches it server-side; the client only ever sees the per-console scoped ticket. - V2P root command-injection — ESXi→PVE migration inputs (
esxi_datastore/esxi_vm_dir) are now strictly allowlist-validated at the API boundary and re-validated before use, plus quoted in the SSHFS mount path. Closes a root command-injection on the PVE node reachable by a default migrate-permission user.
High
- Console authorization — every console path (VNC route, in-process + standalone WS proxies, termproxy ticket) now enforces cluster access and per-VM
vm.consoleaccess. Previously only the permission was checked, so a console user could reach any VM on any cluster/tenant. - API-token scope — token permissions are evaluated against the token's own (floored) role, not the owner's. An admin-owned viewer/user token no longer inherits admin on permission-guarded routes.
- Hardening — web-push re-validates its target server-side; the plain→SQLCipher migration's plaintext DB backup is now securely shredded after a short window instead of retained next to the keystore; chunked request bodies are size-capped (no Transfer-Encoding OOM bypass).
Medium
- Tenant isolation — cluster-group endpoints read the correct tenant field (cross-tenant group/metrics leak fixed) and the manual cross-cluster balance + history now enforce group ownership.
- SSRF — alert webhook channels (Slack/Discord/Teams/ntfy/generic) pass the SSRF guard before sending, and ACME/SIEM/site-recovery outbound calls no longer follow redirects to internal hosts; ACME also re-validates every directory-supplied follow-on URL.
✨ UI
- Corporate Layout polish within its flat Clarity aesthetic — theme-aware metric/threshold colors (light mode now correct), keyboard focus rings on toolbar buttons, smoother dropdown/menu transitions, tidier spacing.
🛠 CI / packaging
- Docker image now builds only on a released version tag (not on every
mainpush). - The LXC template also ships as a stable
pegaprox-latest-lxc-amd64.tar.xz, soreleases/latest/download/always resolves to the newest build (mirroring Docker's:latest).
Also rolls up the 30-cluster / 100-node scaling + stability hardening (off-hub metrics reads/writes, broadcast throttling, watched-cluster gating, bounded caches, syslog-receiver DoS fix + UI toggle).
Update: in-app updater (Settings → Updates) or
bash update.sh. Docker:docker pull ghcr.io/pegaprox/pegaprox:latest.
💎 Platinum Sponsors
- netwolk GmbH — Swiss managed-services partner
- Expertize.nl — Dutch Proxmox specialists
PegaProx lives entirely from sponsorships and donations — server costs, certificates and the developer hours behind every release. Massive thanks 🙌. Sponsor PegaProx → opencollective.com/pegaprox | pegaprox.com/#sponsor